Cisco Patches a Dozen Critical Vulnerabilities

What it is

Cisco's October patch release addresses 35 vulnerabilities across Meraki, License On-Prem, NX-OS, APIC, and Finesse. Beyond the CVEs already named, the page adds a Meraki fix (CVE-2026-76464, the most severe of seven grouped Meraki CVEs covering memory issues like buffer overflows and out-of-bounds writes) and additional NX-OS and License On-Prem details not in the existing summary.

How it works

• NX-OS: two more CVEs (CVE-2026-76455, CVE-2026-76459) group multiple improper access control and out-of-bounds write flaws together, separate from the unauthenticated root RCE pair already noted.
• License On-Prem: three additional CVEs (CVE-2026-76482, CVE-2026-76480, CVE-2026-76483) cover missing authentication, improper verification of cryptographic signature, and insufficiently protected credentials — distinct from the auth-bypass/DoS pair already summarized.
• APIC: the three critical CVEs (CVE-2026-76498/76499/76500) span improper access control, OS injection, and memory flaws.

Preconditions / Affected

Three NX-OS CVEs (CVE-2026-76485, CVE-2026-76486, CVE-2026-76501) only trigger on Nexus 3000 and Nexus 9000 series switches with Next Generation OAM (NGOAM) enabled — a specific feature-gated exposure not captured elsewhere.

What to do

Cisco states fixes are available via its standard security advisories/notifications; no specific upgrade commands are given on this page. Cisco reports none of the 35 vulnerabilities are currently exploited in the wild, and the Finesse SSRF (CVE-2026-20362) is publicly disclosed but only high- (not critical-) severity.

Caveats

The page does not list affected version ranges or patch version numbers for any product — only CVE groupings and flaw types.